A supply chain finance platform where suppliers submit invoices, buyers approve them, and finance officers manage financing requests. The cloud infrastructure (Azure) and backend (FastAPI) aim to demonstrate enterprise-grade identity architecture using Azure Entra ID and Azure Entra External ID.
React never touches a token. FastAPI is the OAuth client — it exchanges auth codes, holds tokens server-side, and communicates with the browser via an httpOnly session cookie. This eliminates the token-in-browser attack surface entirely.
Two separate identity tenants:
| User type | Identity provider | Roles |
|---|---|---|
| Suppliers, Buyers | Azure Entra External ID (CIAM) | Supplier, Buyer |
| Finance Officers, Admins | Azure Entra ID (workforce) | FinanceOfficer, Admin |
Tokens are validated locally via JWKS — no introspection endpoint roundtrip on every request.
cd backend
pip install -r requirements.txt
uvicorn main:app --reload --port 8000| Role | Password | |
|---|---|---|
| Supplier | supplier@tradelinksupplychain.onmicrosoft.com | TempPass123! |
| Buyer | buyer@tradelinksupplychain.onmicrosoft.com | TempPass123! |
| FinanceOfficer | financer@allysongoff.onmicrosoft.com | TempPass123! |
| Admin | admin@allysongoff.onmicrosoft.com | TempPass123! |
These are sandboxed demo accounts with no real data behind them. There is no database nor write capabilities.
| Layer | Technology |
|---|---|
| Frontend | React 18 + Vite |
| Backend | FastAPI (Python 3.12) |
| Auth | Azure Entra External ID + Azure Entra ID |
| Hosting | Azure Static Web Apps (frontend) + Azure Container Apps (backend) |
| Registry | Azure Container Registry |
| CI/CD | GitHub Actions (OIDC — no stored secrets) |
Copy .env.example to .env and fill in the values. See infrastructure/AZURE.md for how to provision all Azure resources and obtain these values.
- Phase 1 (current): Role-filtered KPI dashboard, read-only, mock data
- Phase 2: Full CRUD — invoice submission, approval workflows, financing requests